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new Case 


ICO consultation on the draft right of access 
guidance 


Q1 


Does the draft guidance cover the relevant issues about the right of access? 
© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don’t know, what other issues would you like to be covered in it? 


Q2 


Does the draft guidance contain the right level of detail? 


© Yes 
©) No 

©) Unsure / don't know 

If no or unsure/don't know, in what areas should there be more detail within the draft 
guidance? 


Q3 


Does the draft guidance contain enough examples? 
© Yes 
—) No 

©) Unsure / don't know 

If no or unsure/don’t know, please provide any examples that think should be included in 
the draft guidance. 


Q4 


We have found that data protection professionals often struggle with applying and 
defining ‘manifestly 

unfounded or excessive’ subject access requests. We would like to include a wide 

range of examples 

from a variety of sectors to help you. Please provide some examples of manifestly 
unfounded and excessive 

requests below (if applicable). 


Please refer to our response to question 8. 


Q5 Ona scale of 1-5 how useful is the draft guidance? 


3- 
1-Notatall 2-Slightly Moderately 4-—Very 5-Extremely 
useful useful useful 


useful useful 


( ) C) o) C) ( 
taa ta “al a 


Q6 Why have you given this score? 


We think that the guidance provides more clarity on some issues (for example 


timescales, disclosure of third-party confidential information, requests made via 
portals) and gives some useful examples. 


Q7 To what extent do you agree that the draft guidance is clear and easy to understand? 


Strongly 
disagree Disagree 


Neither agree Strongly 
nor disagree Agree agree 


O © O 


Q8 


Q9 


Please provide any further comments or suggestions you may have about the draft 
guidance. 


We have one comment on the draft guidance, concerning requests made by a third 
party on behalf of a data subject (pages 10-12). Specifically, this concerns an 
online platform that facilitates sending subject access requests to organisations on a 
purely speculative basis. The example we have seen is a platform which sends out 
subject access requests on behalf of firms of solicitors in an attempt to track down 
assets for those subject to mental capacity orders. We note the guidance on p.12 
that a request made by a solicitor (or “attorney”) in this context should be viewed as 
having the required authority, however that is not the issue. These speculative 
requests are made to companies on the financial services register, despite having no 
information to suggest that assets are held by those companies or that there was 
any relationship with the data subject at any time. They may not even be 
addressed to a particular data controller (we act as a data processor on behalf of a 
number of different data controllers). The request does not contain enough 
information to discern the identity of a data controller. In other words, it is a scatter 
gun approach. Where enough information is provided in the request that would help 
us to identify a particular controller, we would pass this on to the relevant controller. 
But in the absence of such information, and where the originator cannot provide 
further clarification, we feel it is inappropriate for us as a data processor to search 
the records for all data controllers for whom we process data. That would in our view 
amount to unauthorised access to data (i.e. a blanket search which is not processing 
instructed by the controller). It should be noted that there are mechanisms that 
would allow solicitors or other third parties to identify assets and the correct data 
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Are you answering as: 

C) An individual acting in a private capacity (eg someone providing their views as a member of the public) 
(`) An individual acting in a professional capacity 

© On behalf of an organisation 

€ ) Other 

Please specify the name of your organisation: 

Hymans Robertson LLP 


What sector are you from: 
Financial services 


Q10 How did you find out about this survey? 
©) ICO Twitter account 
(_ ) ICO Facebook account 
(_) ICO LinkedIn account 
C) ICO website 
©) ICO newsletter 
( ) ICO staff member 
(_) Colleague 
(_) Personal/work Twitter account 
(_) Personal/work Facebook account 
(_) Personal/work LinkedIn account 
(_) Other 
If other please specify: 


